Methods and systems for trending issue identification in text streams

ABSTRACT

This application relates to a systems and methods for trending issue identification in text streams. In one embodiment, a method for improving resolution of a trending issue identified in a set of text streams includes presenting a user interface of an application that is being executed by a computing device. The method also includes receiving a notification including the trending issue that has been identified in the set of text streams based at least in part on textual analysis performed on the set of text streams, and presenting the trending issue on the user interface of the application to enable an action to be performed to resolve the trending issue.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of U.S. application Ser. No.16/425,854, entitled “METHODS AND SYSTEMS FOR TRENDING ISSUEIDENTIFICATION IN TEXT STREAMS,” filed May 29, 2019, the content ofwhich is incorporated by reference herein in its entirety for allpurposes.

FIELD

The described embodiments relate generally to textual analysis. Moreparticularly, the present embodiments relate to methods and systems toidentifying a trending issue in text streams based at least on textualanalysis of the text streams.

BACKGROUND

Users may use computing devices to transmit text streams in manydifferent forms. For example, a user may compose an electronic message(email) including a text stream and transmit the email over a network toa target email address. In other examples, text streams may be includedin transcriptions of telephone calls, reviews, social media posts, textmessages, chat histories, and so forth. In one specific scenario, afirst user may transmit an email including a text stream when the userdesires technical support and/or customer support from an entity thatprovides software applications and/or computing devices. In someinstances, other users may transmit a similar text stream included in anemail at or around the same time as the first user to the entity.

SUMMARY

Accordingly, representative embodiments set forth herein disclosevarious techniques for trending issue identification in text streams byperforming textual analysis on the text streams. The techniquesdisclosed herein may identify issues that may otherwise go undiscoveredand/or may identify trending issues quicker than conventionaltechniques. Accordingly, at least some benefits of the disclosedtechniques include improved resolution speed of the trending issuesidentified in the text streams.

According to some embodiments, a method for improving resolution of atrending issue identified in a set of text streams, the method caninclude: (1) presenting a user interface of an application that is beingexecuted by a computing device, (2) receiving a notification includingthe trending issue that has been identified in the set of text streamsbased at least in part on textual analysis performed on the set of textstreams, and (3) presenting the trending issue on the user interface ofthe application to enable an action to be performed to resolve thetrending issue.

According to some embodiments, a method for identifying a trending issuein input data including a set of text streams, the method can include:(1) receiving the input data including the set of text streams, (2)performing textual analysis on the set of text streams to determine atrending issue presented in the set of text streams, and (3)transmitting a notification pertaining to the trending issue to acomputing device to enable an action to be performed to resolve thetrending issue.

Other embodiments include a non-transitory computer readable storagemedium configured to store instructions that, when executed by aprocessor included in a computing device, cause the computing device tocarry out the various steps of any of the foregoing methods. Furtherembodiments include a computing device that is configured to carry outthe various steps of any of the foregoing methods. Other embodimentsinclude a system having a processor that is configured to carry out thevarious steps of any of the foregoing methods.

Other aspects and advantages of the invention will become apparent fromthe following detailed description taken in conjunction with theaccompanying drawings that illustrate, by way of example, the principlesof the described embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

The disclosure will be readily understood by the following detaileddescription in conjunction with the accompanying drawings, wherein likereference numerals designate like structural elements.

FIG. 1 illustrates a high-level component diagram of an illustrativesystem architecture, in accordance with some embodiments.

FIG. 2 illustrates a lower-level component diagram of the illustrativesystem architecture of FIG. 1 , in accordance with some embodiments.

FIG. 3 illustrates an example user interface presenting an overallvolume of received text streams, and trending issues identified in thetext streams, in accordance with some embodiments.

FIG. 4 illustrates an example user interface presenting informationpertaining to common keyword usage in text streams, in accordance withsome embodiments.

FIG. 5 illustrates an example user interface presenting informationpertaining to anomalous keyword usage in text streams, in accordancewith some embodiments.

FIG. 6 illustrates an example user interface presenting options tosearch for additional terms or combination of terms to retrieve textstreams including those terms in a given time period, in accordance withsome embodiments.

FIG. 7 illustrates an example user interface presenting informationpertaining to a spam text stream template detected and the contents ofthe text streams corresponding to the spam text stream template, inaccordance with some embodiments.

FIG. 8 illustrates an example user interface presenting a graph formonitoring the overall volume of received text streams over a period oftime, in accordance with some embodiments.

FIG. 9 illustrates an example user interface presenting time seriesgenerated for keywords that may be used to determine whether keywordsare anomalous keywords, in accordance with some embodiments.

FIG. 10 illustrates a method for improving resolution of a trendingissue identified in a set of text streams, in accordance with someembodiments.

FIG. 11 illustrates a method for identifying a trending issue in inputdata including a set of text streams, in accordance with someembodiments.

FIG. 12 illustrates a method for performing textual analysis on textstreams to identify a trending issue in the text streams, in accordancewith some embodiments.

FIG. 13 illustrates a detailed view of an exemplary computing devicethat can be used to implement the various apparatus and/or methodsdescribed herein, in accordance with some embodiments.

DETAILED DESCRIPTION

Representative applications of methods and apparatus according to thepresent application are described in this section. These examples arebeing provided solely to add context and aid in the understanding of thedescribed embodiments. It will thus be apparent to one skilled in theart that the described embodiments may be practiced without some or allof these specific details. In other instances, well known process stepshave not been described in detail in order to avoid unnecessarilyobscuring the described embodiments. Other applications are possible,such that the following examples should not be taken as limiting.

In the following detailed description, references are made to theaccompanying drawings, which form a part of the description and in whichare shown, by way of illustration, specific embodiments in accordancewith the described embodiments. Although these embodiments are describedin sufficient detail to enable one skilled in the art to practice thedescribed embodiments, it is understood that these examples are notlimiting; such that other embodiments may be used, and changes may bemade without departing from the spirit and scope of the describedembodiments.

Identifying common themes or trends in text streams may serve importantpurposes for various entities. For example, entities that providesoftware applications (e.g., application distribution platforms (“appstores”), media distribution platforms (iTunes® by Apple® of Cupertino,Calif.), etc.), services (e.g., cloud-based storage), computing devices(e.g., smartphones, tablets, laptops, desktops, media players, etc.),etc. may benefit from being able to quickly, reliably, and/or accuratelydetect trending customer support issues and/or technical support issuesas they arise in text streams. The disclosed techniques may enablereducing the time used to escalate issues to the proper customsupport/technical support group and/or the time used to resolve theissues by the custom support/technical support group of the entities. Asa result, customer experience may be improved by the disclosedtechniques.

Other entities that may benefit from the disclosed techniques mayinclude entities that monitor for malicious behavior online. Thetechniques may improve the speed of detection of trending issues, suchas a virtual attack, that is being discussed on a chat forum, forexample. As a result, the techniques may enable thwarting such trendingissues that are detected in a timelier manner. Accordingly, security maybe enhanced using the disclosed trending issue identificationtechniques.

Although the following discussion focuses on detecting issues in thecustomer support/technical support scenario, it should be understoodthat the disclosed techniques may apply to any suitable instance whereit is beneficial to detect trending issues in text streams. In someinstances, when users experience an issue using a software applicationand/or a computing device of an entity, the user may compose a textstream in an electronic message (e.g., email) and transmit the email tothe entity. The issue may be any suitable issue relating to the softwareapplication, the computing device, and/or the entity. For example, theissue may relate to the software application being down, a feature ofthe software application not functioning properly, the computing deviceperforming in an undesired manner in certain circumstances, the user'saccount needing servicing, billing questions, and so forth.

The entity may receive the email and be dispatched to a supportrepresentative. If the support representative knows what the resolutionis, then the support representative may respond to the user describingthe solution to the issue in the received email. However, if there is atrending issue that affects numerous users, and these numerous users aresending emails including text streams describing the trending issue tothe entity, the support representative may have no way of knowing thatthis is a trending issue affecting multiple users. The supportrepresentative may have no way of knowing that this trending issueshould be escalated quickly to a production support and/or engineeringteam immediately. Typically, if the support representative sees severalof the same issues in a time period, the support representative may votethe issue up in a list of issues to be addressed by a production supportand/or engineering team. However, this escalation process may beundesirable and the resolution time for trending issues leaves much tobe desired.

Accordingly, aspects of the present disclosure generally relate toimproving trending issue identification in text streams. The disclosedtechniques may perform textual analysis (e.g., learning techniques,preprocessing, filtering, text mining, anomaly detection, etc.) on textstreams (e.g., emails, chat histories, reviews, transcriptions,dictations, etc.) automatically to proactively identify trending issuesas close to the source as possible. A trending issue may refer to anissue that is described in a threshold number of text streams in certaintime period. The textual analysis may use a combination of naturallanguage processing, machine learning models, time series anomalydetection, and so forth to identify the trending issues. The disclosedtechniques may monitor the overall volume of text streams and trendingissues or common themes included in the text streams. Further, thedisclosed techniques may filter certain text streams that includetextual patterns identified as pertaining to malicious intent oractivity (e.g., spam emails, phishing emails, scam emails, etc.). Thedisclosed techniques may enable surfacing trending issues to therelevant support groups of an entity more quickly than the conventionalvoting escalation described above. Further, the disclosed techniques mayenable identifying and flagging trending issues that may otherwise goundetected. This may lead not only to an improved customer experience,but to an optimization of the workflow for production support and/orengineering teams to resolve the trending issues that may be detectedmore quickly.

The identified trending issues in the text streams may be presented in asupport user interface on a computing device to enable an action to beperformed to resolve the trending issue. The action may be any suitableaction appropriate for the type of trending issue. For example, if thetype of trending issue relates to a service or software applicationbeing down and/or not responding, one suitable action may includerestarting one or more servers to reestablish the service or softwareapplication. If the type of trending issue relates to a function of thesoftware application not performing properly, one suitable action mayinclude escalating the trending issue to the engineering team to developand deploy a software patch to fix the trending issue.

In some embodiments, when a set of text streams are received orobtained, the set of text streams may be input into one or more machinelearning models that are trained to identify patterns corresponding tomalicious activity or intent and to filter out any text streams thatinclude the identified patterns. These filtered out text streams may bestored in a data store for review. The remaining set of text streamssans the filtered out text streams may be preprocessed by tokenizing oneor more words in the text streams, removing one or more words, addingone or more words, removing carriage returns, correcting misspelledwords, adjusting formatting, and so forth. The remaining set ofpreprocessed text streams may be parsed using natural languageprocessing techniques to extract keywords and the number of occurrencesof the keywords in the text streams over time. The term “keywords” mayrefer to a word and/or a phrase that is determined to be of interest.The determination of which keywords to extract may be preset based onknowledge of domain experts or may be learned by a machine learningmodel based on a set of training data. In some embodiments, weights maybe assigned to the keywords based on their relevance to certain issuesand the importance of those certain issues. For example, “down” as akeyword may receive a strong weight because the keyword “down” mayrelate to an issue of a software application or service being down,which may be a relatively important issue.

Historical data of the number of occurrences of the keywords in the textstreams over a certain time period (e.g., a 24 hour period) may be usedto generate a respective time series for each of the keywords. The timeseries may represent (e.g., in a line chart, bar chart, table, etc.) thenumber of occurrences of a respective keyword at each timestamp over thecertain time period. Anomaly detection may be applied to the time seriesby comparing the time series to determine if any of the keywords share acommon trait based on the time series. The common trait may refer to anincrease of occurrence of the keywords at a certain timestamp in thetime series. If any of the keywords share the common trait, thosekeywords may be identified as anomalous keywords. For each period oftime (e.g., the 24 hour period), the anomalous keywords are used tosearch for every text stream that includes the anomalous keywords thatwas received in that period of time. The retrieved text streams thatinclude the anomalous keywords may be clustered into one or moreclusters of text streams. The clusters of text streams may representdifferent types of text streams that include some of the same anomalouskeywords describing the same issue. In some embodiments, the clusters oftext streams may be ranked based on weights assigned to the anomalouskeywords present in each of the clusters of text streams. For example,if a first text stream in a cluster includes more occurrences of ananomalous keyword having a strong weight than a second text stream inthe cluster, then the first text stream may be ranked higher in thecluster. Moreover, if a first cluster of text streams includes anomalouskeywords with stronger weights than a second cluster of text streams,then the first cluster may be ranked higher than the second cluster.

The ranked clusters of text streams may be used to identify a trendingissue. For example, a highest ranking cluster of text streams may bedetermined to represent the trending issue and a notification may betransmitted to a computing device to provide an alert pertaining to thetrending issue. In some embodiments, there may be more than one clusterof text streams that each relate to a different trending issue andnotifications pertaining to the trending issues represented by a certainnumber (e.g., top five, top ten, top 20, etc.) of the highest rankingclusters of text streams may be transmitted to the computing device toprovide the alerts pertaining to the trending issues.

Various user interfaces of an application executing on the computingdevice may present the trending issue(s) and/or overall volume of textstreams received for certain time periods. Further, the user interfacesmay present summary level and detail level information pertaining tokeywords (e.g., normal, anomalous), and present the text streamsassociated with the keywords. In some embodiments, the time series foreach keyword may be presented on the user interfaces. The disclosedtechniques may provide an enhanced user interface provides the textstreams associated with identified trending issues and/or anomalouskeywords in a single user interface. This may prevent the user fromperforming multiple searches attempting to piece together a correlationbetween myriad text streams to determine whether there is a trendingissue. Reducing the number of searches may reduce the network resources,memory resources, and/or processing resources consumed by a serverand/or computing device.

These and other embodiments are discussed below with reference to FIGS.1-13 ; however, those skilled in the art will readily appreciate thatthe detailed description given herein with respect to these figures isfor explanatory purposes only and should not be construed as limiting.

FIG. 1 illustrates a high-level component diagram of an illustrativesystem architecture 100, in accordance with some embodiments. In someembodiments, the system architecture 100 may include a computing device102 communicatively coupled to a cloud-based computing system 104 via anetwork 106. Another computing device 108 may also be communicativelycoupled to the cloud-based computing system 104. As used herein, acloud-based computing system may refer, without limitation, to anyremote computing system accessed over a network. In some instances, thecomputing device 102 and the computing device 108 may be communicativelycoupled via the network 106. Each of computing device 102 and 108 mayinclude one or more processing devices, memory devices, and networkinterface devices. Network 106 may be a public network (e.g., theInternet), a private network (e.g., a local area network (LAN) or widearea network (WAN)), or a combination thereof.

The computing device 102 may be any suitable computing device, such as alaptop, tablet, smartphone, or computer. The computing device 102 mayinclude a display that is capable of presenting a user interface 110 ofan application 112. The application 112 may be implemented in computerinstructions stored on the one or more memory devices of the computingdevice 102 and executable by the one or more processing devices of thecomputing device 102. The application 112 may be a stand-aloneapplication that is installed on the computing device 102 or may be anapplication (e.g., website) that executes via a web browser. The userinterface 110 may present information pertaining to trending issuesdetected in text streams, anomalous keywords detected using atime-series generated for each keyword, other keywords extracted fromthe text streams, an overall volume of text streams received for acertain time period, various actions that are available to be performed,and so forth.

The computing device 108 may be any suitable computing device, such as alaptop, tablet, smartphone, or computer. The computing device 108 maystore computer instructions implementing one or more applications on oneor more memories, and the computer instructions may be executable by oneor more processors of the computing device 108. In some embodiments, theapplications may enable a user to generate a text stream 114 that mayinclude alphanumeric characters arranged to form words in a suitablelanguage (e.g., English, Spanish, French, etc.). The words may bearranged to form phrases that are included in sentences. The sentencesmay be arranged to form paragraphs, and so forth. In an example, thetext stream 114 may be included in an electronic message (email). Thetext stream 114 may describe an issue the user encountered with asoftware application and/or a computing device provided by an entity.

The computing device 108 may transmit the text stream 114 to thecloud-based computing system 104 via the network 106. In someembodiments, the cloud-based computing system 104 may include one ormore servers 116 that form a distributed computing architecture. Each ofthe servers 110 may include one or more processors, memory devices, datastorage, and/or network interface devices. The servers 116 may be incommunication with one another via any suitable communication protocol.The servers 116 may include various components, implemented in computerinstructions and executable by one or more processors, thatautomatically identify trending issues in the text streams 114 usingtextual analysis and provide notifications 118 regarding the trendingissues to the computing device 102, as described further below withreference to FIG. 2 .

The cloud-based computing system 104 may include a training engine 120configured to generate one or more machine learning models 122. In someembodiments, the training engine 120 may be included in or separate fromthe server 116. The training engine 120 may be a rackmount server, arouter computer, a personal computer, a portable digital assistant, asmartphone, a laptop computer, a tablet computer, a camera, a videocamera, a netbook, a desktop computer, a media center, or anycombination of the above. The one or more machine learning models 122may refer to model artifacts that are created by the training engine 120using training data that includes training inputs and correspondingtarget outputs. The training engine 120 may find patterns in thetraining data that map the training input to the target output, andgenerate the machine learning models 122 that capture these patterns.

In some embodiments, to generate, train, and validate the machinelearning models 122, the training engine 120 may use a training data setincluding text streams having certain patterns or templates that aredetermined to correspond to malicious activity or intent. For example,the patterns or templates may reflect an ordering of words and/orsentences that are determined to be associated with spam, scams, and/orphishing. The machine learning models 122 may be trained to identifythese patterns or templates in text streams and flag these text streamsso that they may be filtered from the set of text streams that are to beused for trending issue identification. The machine learning models 122may include one or more of a neural network, such as a recurrent neuralnetwork, convolutional network, generative adversarial network, a fullyconnected neural network, or some combination thereof, for example. Insome embodiments, the machine learning models 122 may be composed of asingle level of linear or non-linear operations or may include multiplelevels of non-linear operations. For example, the machine learning model122 may include numerous layers and/or hidden layers that performcalculations (e.g., dot products) using various neurons.

The machine learning models 122 may identify the text streams 114 thatinclude the patterns or templates, and those text streams 114 may befiltered out and may be stored in a data store 124 of the cloud-basedcomputing system 104. The servers 116 may also use the data store 124 tostore the set of text streams that have been preprocessed, the keywordsextracted from the text streams, information related to the extractedkeywords, the anomalous keywords identified using the time series foreach of the keywords, the trending issue that is identified, and soforth. The data store 124 may be separate from or included in any of theservers 116 and/or the training engine 120.

In some embodiments, the filtered out text streams 114 may be reviewedon the user interface 110 by a support representative to determine whichpatterns or templates are being used in text streams 114 for a giventime period. For example, the support representative may determinenumerous occurrences of text streams 114 including a particular scamtemplate are received at the same or similar time each day. Thisinformation may be useful to further train the machine learning models122 to finely tune how the machine learning models 122 identify textstreams 114 including the patterns or templates associated withmalicious activity or intent.

The set of text streams 114 excluding the filtered out text streams maybe used to identify the trending issue for a certain time period. When atrending issue is identified using the disclosed techniques, thenotification 118 may be transmitted to the computing device 102 via thenetwork 106. The application 112 of the computing device 102 maypresent, on the user interface 110, various information pertaining tothe trending issue identified in the notification 118. This informationmay enable an action to be performed to resolve the trending issue.

FIG. 2 illustrates a lower-level component diagram of the illustrativesystem architecture 200 of FIG. 1 , in accordance with some embodiments.As depicted, the server 116 in the cloud-based computing system 104includes numerous components, such as a text stream filtering component201, a text stream processing component 202, a text stream analyticscomponent 204, and a notification component 206. The components 201,202, 204, and 206 may be implemented in computer instructions stored onone or more memories of the server 116 and may be executable by one ormore processors of the server 116. The components 201, 202, 204, and/or206 may perform operations that are referred to as textual analysisherein.

The text stream filtering component 201 may receive one or more textstreams 114 that are sent by the computing device(s) 108 via the network106. The text streams 114 may be included in emails, social media posts,reviews, dictations, chat histories, etc. The text stream filteringcomponent 201 may input the one or more text streams 114 into the one ormore machine learning models that are trained to identify one or moretextual patterns or templates that correspond to malicious activity(e.g., spam, scam, phishing, etc.) in the text streams 114. The textstreams 114 that are identified as included the textual patterns ortemplates by the machine learning models 122 may be flagged as spam textstreams 208 and may be filtered out from the one or more text streams114 that are to be processed by the text stream processing component202. The spam text streams 208 may be stored in the data store 124 forfurther analysis.

After filtering is complete, the one or more text streams 114 may besent to the text stream processing component 202. The text streamprocessing component 202 may transform the text streams 114 into a formthat may be consumed by the text stream analytics component 204. Forexample, the text stream processing component 202 may tokenize certainwords in the text. Tokenization may refer to breaking a sequence ofstrings in the text stream 114 into pieces such as words, keywords,phrases, symbols, and/or other elements referred to as tokens. Tokensmay be individual words, phrases, or whole sentences. The text streamprocessing component 202 may also remove certain punctuation marksand/or stop characters/symbols. The preprocessed text streams 114 may bestored in the data store 124. Each of the preprocessed text streams 114may be associated with a timestamp at which the text stream 114 wastransmitted. The timestamp for each text stream 114 may also be storedin the data store 124, along with other data related to the text stream114, such as the subject of the text stream 114, the sending address ofthe text stream 114, and so forth.

The text stream analytics component 204 may retrieve the preprocessedtext streams 114 from the data store 124. The text stream analyticscomponent 204 may parse the text streams 114 retrieved from the datastore 124 and extract keywords and determine a number of occurrences ofthe keywords in each of the text streams. The text stream analyticscomponent 204 may as sign a weight to each of the keywords. The weightsmay be preset for certain keywords based on domain expert knowledge. Forexample, a keyword “unresponsive” may be weighted more heavily than akeyword “username”. The text stream analytics component 204 may alsoretrieve the timestamp corresponding to each of the text streams 114.For a certain time period (e.g., a 24 hour time period), the text streamanalytics component 204 may generate a time series for each keywordextracted from the text streams 114 based on the number of occurrencesof the keywords and the timestamp of the text streams. Thus, a set oftime series may be generated for the keywords. Each time series mayrepresent the number of occurrences of a respective keyword in the textstreams 114 for the certain time period based on the timestamps.

The text stream analytics component 204 may perform anomaly detection bycomparing the time series for each of the keywords to determine if anyof the keywords share a common trait. The common trait may refer tokeywords having an increase in occurrences at a certain timestamp in theset of time series. In some embodiments, a determination may be madewhether the increase in occurrences for the keywords satisfies athreshold condition (e.g., the increase is a certain number occurrenceshigher than a threshold number, or is a percentage higher than thenumber of occurrences at an earlier timestamp, etc.) when determiningwhether the keywords share the common trait.

Keywords that share the common trait in the set of time series may beidentified as anomalous keywords for the certain time period. The textstream analytics component 204 may search the data store 124 for asubset of the text streams 114 that include the anomalous keywordsduring that certain time period. When the subset of the text streams 114is retrieved, the text stream analytics component 204 may cluster thesubset of the text streams 114 using one or more similarity metrics. Thesimilarity metrics may refer to how similar are the anomalous keywordsincluded in each of the text stream 114 in the retrieved subset. Anysuitable clustering technique may be used, such as k-means, where thesubset of text streams 114 are partitioned into k clusters in which eachtext stream belongs to the cluster with the nearest mean. The clustersmay represent different types of issues identified based on thesimilarity of the anomalous keywords included in the subset of textstreams 114. For example, text streams 114 including “application” and“down” that are identified as anomalous keywords may be clusteredtogether while text streams 114 including “account” and “billing” thatare identified as anomalous keywords may be clustered together.

The text stream analytics component 106 may rank the clusters of textstreams 114 based in part on the weights of the anomalous keywordsincluded in the clusters of text streams 114. In some embodiments, theclusters of text streams 114 may be ranked, such that there is a firstcluster, a second cluster, and so forth, while the text streams 114within each of the clusters may also be ranked, such that there is afirst text stream, a second text stream, and so forth. In someembodiment, the ranking be used to surface the most relevant cluster asthe trending issue and may provide the most representative text stream114 in that cluster. In some embodiments, each of the clusters may bepresented as trending issues in the ranked or unranked order. Further,the text streams 114 included in each cluster may be presented in theranked or unranked order.

Any information generated by the text stream analytics component 106 maybe stored in the data store 124. For example, the anomalous keywordsthat were detected based on the set of live streams for the keywords maybe stored in the data store 124. Further, the data used to produce thelive streams may be stored in the data store 124. The clusters of textstreams may be stored in the data store 124 in the ranked or unrankedorder, as well.

The text stream analytics component 106 may transmit the identifiedtrending issues including the text streams 114 that describe thetrending issue(s) and the anomalous keywords included in those textstreams 114, along with other information, to the notification component106. The notification component 106 may transmit one or morenotifications 118 to the computing device 102 to present the identifiedtrending issue(s) in the text streams 114 and to enable resolution ofthe trending issue(s).

The text stream analytics component 106 may provide the detectedanomalous keywords and/or the text streams including the anomalouskeywords to the text stream filtering component 106. The text streamfiltering component 106 may use the anomalous keywords and/or textstreams including the anomalous keywords to update the machine learningmodels 122 (e.g., via the training engine 120) to identify subsequenttext streams 114 that include similar text streams having the anomalouskeywords. This may provide for enhanced identification of the issuesdescribed in these text streams 114.

FIG. 3 illustrates an example user interface 110 presenting an overallvolume 300 of received text streams 114, and trending issues identifiedin the text streams 114, in accordance with some embodiments. Theinformation presented on the user interface 110 may be obtained from theserver 116 of the cloud-based computing system 104. The text streams 114may be included in emails in the depicted example. The overall volume300 is represented in a bar chart where the number of text streams 114received are presented on the y-axis and the days for particular periodof time that the text streams 114 were received are depicted on thex-axis. As depicted, the bar chart presents the overall volume 100 oftext streams 114 for days “7/1”, “7/2”, “7/3”, and “7/4”. The overallvolume 300 of text streams 114 was approximately 3000 on 7/1,approximately 2200 on 7/2 and 7/3, and approximately 3000 on 7/4. A line302 in the bar chart illustrates the change in the overall volume 300between the days.

In addition, various information pertaining to the top trending issuesthat are identified most frequently in the overall volume 300 of textstreams 114 for the particular period of time may be presented on theuser interface 110. As discussed herein, the trending issues may beidentified in the text streams automatically using textual analysisincluding at least comparing time series of respective keywords todetermine if the keywords share a common trait that corresponds to ananomaly. For example, a visual representation 304 may be presented onthe user interface 110 for top products that are referenced inidentified trending issues described in the text streams 114. The topproducts that are reference in identified trending issues include “AppStore” 1335 times, “Smartphone” 517 times, “OS apps” 223 times, and“Media Player” 60 times. A visual representation 306 may be presented onthe user interface 110 for top categories that are referenced inidentified trending issues described in the text streams 114. The topcategories that are referenced in identified trending issues include“App Store, Music” 945 times, “Purchases, Billing” 901 times, and “GiftCards & Codes” 179 times. A visual representation 308 may be presentedon the user interface 110 for top topics that are referenced inidentified trending issues described in the text streams 114. The toptopics that are referenced in identified trending issues include “AppStore account billing” 388 times, “Unrecognized charge” 229 times, and“Questions about gift cards and codes” 95 times.

In some embodiments, a support representative may drilldown into the topproducts, top categories, or top topics to view additional information.For example, the user may drill down by selecting “App Store accountbilling” to view details related to the anomalous keywords identifiedand the actual text streams 114 that are related to “App Store accountbilling” including those anomalous keywords. The support representativemay take an action resolve the trending issue corresponding to “AppStore account billing”.

FIG. 4 illustrates an example user interface 110 presenting informationpertaining to common keyword usage in text streams 114, in accordancewith some embodiments. Common keywords may be preset duringconfiguration based on domain knowledge expertise for certain issues.However, in some embodiments, the common keywords may be monitored todetermine whether they are being used more than a threshold amount oftimes within a threshold period of time both in relation to generalfeatures and in content-specific domains. These common keywords may beincluded on a whitelist of accepted keywords that may be used in textstreams 114 while the threshold conditions are not satisfied. There maybe various thresholds amount of times set for the common keywords. Forexample, as depicted, the common keywords “album” and “trial” are beingused less than a first threshold and therefore they have been assigned anormal status 400 (further represented by visual representation 402having a color indicating the normal status 400). If the common keywordsare used more than the first threshold amount of times within thethreshold period of time, the common keyword may be assigned a needattention status 404. If the common keywords are used more than a secondthreshold amount of times, higher than the first threshold amount oftimes, within the threshold period of time, the common keywords may beassigned a warning status 406.

As depicted, a line chart 408 may be presented depicting the occurrencesof the common keyword “album” over a number of days, and a line chart410 may be presented depicting the occurrences of the common keyword“trial” over the number of days. These charts 408 and 410 may furtherenhance the ability to detect anomalies in text streams 114, which mayresult in detecting a trending issue that can be solved at an improvedrate.

FIG. 5 illustrates an example user interface 110 presenting informationpertaining to anomalous keyword usage in text streams 114, in accordancewith some embodiments. As discussed herein, the anomalous keywords maybe identified in the text streams by comparing time series for eachkeyword extracted from the text streams 114 to determine whether thekeywords share a common trait that corresponds to an anomaly. The userinterface 110 includes a section 500 for an anomalous keywords detailedview and a section 502 for relevant text stream contents. The section500 provides columns for “Significance” which includes values for “VeryHigh”, “High”, “Medium” and/or “Low. The section 500 also includes acolumn for “Keyword”, “# of associated emails”, “# of occurrence”, “avg.occurrence (prior 3 days)”, and “Actions”.

The significance of an anomalous keyword may be determined based ondividing actual statistics versus normal statistics. For example, onenormal statistic may be set to fifty for a number of occurrences for acertain keyword in a text stream 114 in a day and the actual occurrenceof the certain keyword in the text stream 114 may be two hundred. If theresult of the division is a first number (e.g., 0, 1), then thesignificance may be “Low”. If the result of the division is anothernumber (e.g., greater than 1), then the significance is assigned“Medium”, “High”, or “Very High” based on the degree of variance betweenthe first number and the another number. In some embodiments, thesignificance of the anomalous keyword may be determined based on one ormore factors related to a weight assigned to the anomalous keyword, thenumber of occurrences of the anomalous keyword in the text streams 114,the number of associated emails in which the anomalous keyword isincluded, and/or the average occurrence of the anomalous keyword over aperiod of time.

The “Actions” column may include one or more graphical icons or elementsthat enable the support representative to perform one or more actions.The actions may enable resolution of an identified trending issueincluding the particular anomalous keyword in the section 500. Theaction may include any suitable action based on the type of the trendingissue.

The section 502 for relevant text streams provides the content of thetext streams including one or more of the anomalous keywords identifiedin the section 500. The text stream 113 depicted in the section 502 maybe an example of a trending issue 504 that is identified using thedisclosed techniques. Although just one sample text stream 114 isdepicted, it is noted that numerous different text streams 114 includingany combination of the anomalous keywords presented in section 500 maybe presented in the section 502. As depicted, the anomalous keywords“country”, “region” and “try” are emphasized (e.g., underlined) in thetext stream 114 presented in section 502. Presenting the anomalouskeyword details and the relevant text stream contents including one ormore of the anomalous keywords together on the same user interface 110may enable quick determination of the importance of trending issues 504.

FIG. 6 illustrates an example user interface 110 presenting options tosearch for additional terms or combination of terms to retrieve textstreams 114 including those terms in a given time period, in accordancewith some embodiments. For example, the support representative may enterthe combination of terms “change” and “region” to be searched in textstreams 114 over the time period from 7/1 to 7/4. The user interface 110may present a line chart 600 for the number of occurrences of “change”in the text streams 114 over the given period of time, and a line chart602 for the number of occurrences of “region” in the text streams 114over the given period of time.

Further, a section 604 for a list of emails that include text streams114 with the searched terms “change” and “region” for the given periodof time may be presented in the user interface 110. As depicted, twoemails having ID's 123 and 432, respectively, are presented in thesection 604. Each email in the list 604 includes a portion of the textstream that is included in the email, as well as a timestamp for theemail. If the support representative selects one of the emails in thesection 604, additional details of the email may be presented in asection 606 that corresponds to a detail view for the emails. Thesection 606 displays the email ID, timestamp, topic, product, and thetext stream 114 that is included in the email. As depicted, the searchedterms “change” and “region” are emphasized in the text stream.

FIG. 7 illustrates an example user interface 110 presenting informationpertaining to a spam text stream template detected in the text streams114 received and the contents of the text streams 114 corresponding tothe spam text stream template, in accordance with some embodiments. Thespam text stream template may be detected by the one or more machinelearning models 122 that are trained to identify textual patterns ortemplates that correspond to malicious activity or intent (e.g., spam,scam, phishing, etc.). These emails may be filtered out from the set ofemails that are processed to identify the trending issues 504.

The user interface 110 includes a section 700 for viewing the spam textstream template that is detected. As depicted, the section 700 includesa template ID (“2”), template content of the spam text stream 208detected (“I haven't received an item I bought. I want a refund. Theorder #is MVB232”), and a template feature set (“bought,received,order_id,refund”).

The user interface 110 includes a section 702 for the corresponding spamemails that use the template for spam text streams. As depicted, thereare two emails depicted in section 702 having different timestamps andspam text streams 704 and 706. The spam text streams 704 and 706 includealmost identical words and characters except for the order number. Sucha user interface 110 may be beneficial in that it provides awareness tothe support representatives of the types of malicious emails that arebeing received.

FIG. 8 illustrates an example user interface 110 presenting a graph 800for monitoring the overall volume of received text streams 114 over aperiod of time, in accordance with some embodiments. As depicted, thenumber of occurrences of the text streams 114 is represented on they-axis and the time period including timestamps is represented on thex-axis. The graph 800 depicts that a largest volume 802 of text streamswas received on around time 60, which may correspond to day 7/3. Thelargest volume 802 may be greater than the usual volume of text streams114 received during the other days in the time period. Accordingly, asupport representative or a processor may determine if there are anyanomalous keywords that can be determined for around time 60.

FIG. 9 illustrates an example user interface 110 presenting time series900 and 902 generated for keywords that may be used to determine whetherkeywords are anomalous keywords, in accordance with some embodiments. Atime series 900 is generated and presented for the keyword“Unavailable”, and a time series 902 is generated and presented for thekeyword “App Store”. As depicted, the time series 900 and 902 representthe number of occurrences of the keywords on the y-axis and the timeperiod including timestamps on the x-axis.

A processor may perform anomaly detection using the time series 900 and902 for the keywords “Unavailable” and “App Store” to determine whetherthe keywords share a common trait. The time series 900 and 902 may becompared and it may be determined that the time series 900 includes anincrease 904 of the number of occurrences of the keyword “Unavailable”around time 60, and the time series 902 also includes an increase 906 ofthe number of occurrences of the keyword “App Store” around the time 60.Time 60 may correspond to the day 7/3. Based on the time series 900 and902, the keywords “Unavailable” and “App Store” share a common traitbecause they both share an increase 904 and 906 in the number ofoccurrences at or around the same time. As such, the keywords“Unavailable” and “App Store” may be determined to be anomalouskeywords. A visual prompt 908 may be presented that states “Whathappened on 7/3? “App Store” and “Unavailable” are correlated based onan increase in number of occurrences for both at the same timestamp.”

In some embodiments, a search may be performed in the data store 124 forthe text streams 114 that include the anomalous keywords “Unavailable”and “App Store” at the certain timestamp (e.g., time 60 corresponding tothe day 7/3). The retrieved text streams 114 that include the anomalouskeywords at the certain timestamps may be clustered and ranked toidentify the trending issue(s) 504 to provide to the computing device102 to enable an action to be performed to resolve the trending issue(s)504.

In some embodiments, a cross validation operation may be performed byusing a search engine platform to obtain search results using theanomalous keywords (e.g., “Unavailable” and “App Store”) and the certaintimestamp (e.g., 7/3). As depicted, in section 910 of the user interface110, the search results include three items found on the Internet, forexample, using the search criteria. The three items include (i) “AppStore down”—7/3, published by website A; (ii) “Is the App Store downright now?”—7/3, published by website B; (iii) “App Store goesdown”—7/3, published by website C. If the search results satisfy athreshold condition pertaining to the anomalous keywords, then thetrending issue 504 including the anomalous keywords may be transmittedto the computing device 102. The threshold condition pertaining to theanomalous keywords may refer to a certain number of search results beingobtained that include the anomalous keywords for the searched timestamp.If the threshold condition is not satisfied, the anomalous keywords maybe discarded and the trending issue 504 may not be validated. As aresult, in some embodiments, the trending issue 504 is not sent to thecomputing device 102.

FIG. 10 illustrates a method 1000 for improving resolution of a trendingissue 504 identified in a set of text streams 114, in accordance withsome embodiments. In the following description, the method 1000 iscarried out by an entity that is executing on the computing device 102,e.g., the application 112. However, it is noted that other entities canbe configured to carry out one or more steps of the method 1000 withoutdeparting from the scope of this disclosure, such as the cloud-basedcomputing system 104, for example.

At 1002, a user interface 110 of an application 112 may be presented.The application 112 may be implemented in computer instructions that arebeing executed by the computing device 102. In some embodiments, theapplication 112 may be a support application that is used bycustomer/technical support representatives

At 1004, a notification may be received by the computing device 102. Thenotification may include a trending issue 504 that has been identifiedin the set of text streams 114 based at least in part on textualanalysis performed on the set of text streams. In general, textualanalysis may refer to a combination of one or more of filtering out textstreams based on content therein, preprocessing content of the textstreams, mining keywords of the text streams over time, performinganomaly detection using time series of each keyword, obtaining textstreams that include anomalous keywords, clustering the text streamsincluding the anomalous keywords, ranking the clustered text streams,and/or identifying the trending issue based on the ranked clustered textstreams. The steps of performing textual analysis are described ingreater detail below with regard to method 1200 of FIG. 12 .

At 1006, the trending issue 504 may be presented on the user interface110 of the application 112 to enable an action to be performed toresolve the trending issue 504. For example, the action may includerestarting one or more servers associated with a software application orcomputing device that is the subject of the trending issue, escalatingthe trending issue to the appropriate channel (e.g., production support,engineering team, etc.), providing a mass response to the users thattransmitted emails including the trending issue, and so forth.

FIG. 11 illustrates a method 1100 for identifying a trending issue 504in input data including a set of text streams 114, in accordance withsome embodiments. In the following description, the method 1100 iscarried out by an entity that is executing on the cloud-based computingsystem 104, e.g., the server 116. However, it is noted that otherentities can be configured to carry out one or more steps of the method1100 without departing from the scope of this disclosure, such as thecomputing device 102, for example. The method 1100 may identify atrending issue in input data including a set of text streams 114.

At 1102, input data may be received by the server 116, where the inputdata includes the set of text streams 114. The set of text streams 114may be included in any one or more of emails, text messages,transcriptions, chat histories, reviews, social media posts, and soforth. The text streams 114 may be received from the computing devices108. For example, a user may compose an email including a text stream114 that describes a technical issue of a software application (e.g., afunctionality is not working) provided by an entity and transmit theemail using the computing device 108 (e.g., laptop, tablet, smartphone).

At 1104, textual analysis may be performed on the set of text streams114 to determine a trending issue 504 presented in the set of textstreams 114. The steps of performing textual analysis are described ingreater detail below with regard to method 1200 of FIG. 12 . At 1106, anotification 118 may be transmitted to the computing device 102. Thenotification 118 may pertain to the trending issue 504, and thenotification 118 may enable an action to be performed to resolve thetrending issue 504.

FIG. 12 illustrates a method 1200 for performing textual analysis ontext streams 114 to identify a trending issue 504 in the text streams114, in accordance with some embodiments. In the following description,the method 1200 is carried out by an entity that is executing on thecloud-based computing system 104, e.g., the server 116. However, it isnoted that other entities can be configured to carry out one or moresteps of the method 1200 without departing from the scope of thisdisclosure, such as the computing device 102, for example. Method 1200may improve the resolution of the identified trending issue.

At 1202, one or more keywords may be extracted from a set of textstreams 114. The one or more keywords may be extracted using naturallanguage processing techniques to parse each text stream 114 and extractthe one or more keywords. The keywords may be extracted based on tokensassociated with the keywords. Each of text stream 114 in the set of textstreams 114 may be tokenized during a preprocessing step. A number ofoccurrence of each of the one or more keywords may be determined.Further, the timestamp of each text stream 114 in the set of textstreams 114 may be obtained (e.g., from the data store 124).

At 1204, one or more time series (e.g., 900 and/or 902) may be generatedfor the one or more keywords. A respective time series of the one ormore time series may represent a number of the occurrences of arespective keyword of the one or more keywords in the set of textstreams 114 over a period of time.

At 1206, a subset of the one or more keywords may be determined, wherethe subset of the one or more keywords share a common trait based on theone or more time series. The subset of the one or more keywords may bereferred to as the anomalous keywords herein. The subset of the one ormore keywords may be determined by comparing the one or more time seriesfor the one or more keywords together and identifying the keywords thatshare the common trait. The common trait may include keywords having anincrease in the number of occurrences at a certain timestamp in the oneor more time series.

At 1208, a subset of the set of text streams 114 may be obtained, wherethe subset of the set of text streams includes the subset of the one ormore keywords. That is, a search may performed using the data store 124to obtain the subset of the set of text streams 114 that include thesubset of the one or more keywords at the certain timestamp or during acertain time period.

At 1210, the subset of the set of text streams 114 may be clustered intoone or more clusters of text streams based on one or more similaritymetrics. The similarity metrics may refer to the text streams 114including a threshold number of the same anomalous keywords. Forexample, the text streams 114 that include anomalous keywords “AppStore” and “Unavailable” may be clustered together and the text streams114 that include anomalous “Billing” and “Question” may be clusteredtogether. Any suitable clustering technique may be used, such as k-meansclustering.

At 1212, the one or more clusters of text streams may be ranked based onone or more weights assigned to the subset of the one or more keywordspresent in the one or more clusters of text streams. In someembodiments, the weights may refer to the significance described above.A cluster that includes text streams 114 with anomalous keywords havingstronger weights than the anomalous keywords included in the other textstreams 114 of the other clusters may be ranked higher than the otherclusters. Additionally, if the weights of the anomalous keywordsincluded in text streams 114 of different clusters are the same, but onecluster includes more occurrences of the anomalous keywords than anothercluster, the cluster including the more occurrences may be rankedhigher. Further, the text streams within the clusters may be rankedbased on the weights of the anomalous keywords and/or the occurrence ofthe anomalous keywords included therein.

At 1214, a trending issue 504 may be determined based on the ranking ofthe one or more clusters of text streams 114. For example, a highestranking cluster may be selected and the highest ranking text stream inthat cluster may be selected as the trending issue 504. In someembodiments, numerous trending issues 504 may be selected. For example,a text stream 114 (e.g., highest ranking text stream) in each of thevarious clusters may be selected as trending issues 504.

In some embodiments, a notification 118 may be transmitted to thecomputing device 102. The notification may include the trending issue504 and information pertaining to the trending issue 504. Theapplication 112 executing on the computing device 102 may present, onthe user interface 110, the trending issue 504 and/or informationpertaining to the trending issue 504. Various actions may be presentedon the user interface 110 to enable the support representative to takedirect action on the trending issue as desired. For example, the supportrepresentative may immediately escalate the trending issue to anothergroup (e.g., production support, engineering team, etc.) based on whattype of trending issue 504 is detected. In another example, the supportrepresentative may respond to the user with solution instructions if thetrending issue 504 can be solved by the user that submitted the textstream 114. In another example, if the trending issue 504 is of a typethat the support representative is capable of resolving withoutinvolving others, then the support representative may perform the actionto directly resolve the trending issue 504.

FIG. 13 illustrates a detailed view of an exemplary computing device1300 that can be used to implement the various apparatus and/or methodsdescribed herein, in accordance with some embodiments. In particular,the detailed view illustrates various components that can be included inany of the computing device 102, the computing device 108, and/or thecloud-based computing system 104 (e.g., the server 116 and/or thetraining engine 120) illustrated in FIG. 1 and/or described herein.

As shown in FIG. 13 , the computing device 1300 can include a processor1302 that represents a microprocessor or controller for controlling theoverall operation of computing device 1300. The computing device 1300can also include a user input device 1308 that allows a user of thecomputing device 1300 to interact with the computing device 1300. Forexample, the user input device 1308 can take a variety of forms, such asa button, keypad, dial, touch screen, audio input interface,visual/image capture input interface, input in the form of sensor data,etc. Still further, the computing device 1300 can include a display 1310(screen display) that can be controlled by the processor 1302 to presentvisual information to the user. A data bus 1316 can facilitate datatransfer between at least a storage device 1340, the processor 1302, anda controller 1313. The controller 1313 can be used to interface with andcontrol different equipment through an equipment control bus 1314. Thecomputing device 1300 can also include a network/bus interface 1311 thatcouples to a data link 1312. In the case of a wireless connection, thenetwork/bus interface 1311 can include a wireless transceiver.

The computing device 1300 also include a storage device 1340, which cancomprise a single disk or a plurality of disks (e.g., hard drives), andincludes a storage management module that manages one or more partitionswithin the storage device 1340. In some embodiments, storage device 1340can include flash memory, semiconductor (solid state) memory or thelike. The computing device 1300 can also include a Random Access Memory(RAM) 1320 and a Read-Only Memory (ROM) 1322. The ROM 1322 can storeprograms, utilities or processes to be executed in a non-volatilemanner. The RAM 1320 can provide volatile data storage, and storesinstructions related to the operation of the computing device 1300.

The various aspects, embodiments, implementations or features of thedescribed embodiments can be used separately or in any combination.Various aspects of the described embodiments can be implemented bysoftware, hardware or a combination of hardware and software. Thedescribed embodiments can also be embodied as computer readable code ona non-transitory computer readable medium. The non-transitory computerreadable medium is any data storage device that can store data which canthereafter be read by a computer system. Examples of the non-transitorycomputer readable medium include read-only memory, random-access memory,CD-ROMs, HDDs, DVDs, magnetic tape, and optical data storage devices.The non-transitory computer readable medium can also be distributed overnetwork-coupled computer systems so that the computer readable code isstored and executed in a distributed fashion.

The foregoing description, for purposes of explanation, used specificnomenclature to provide a thorough understanding of the describedembodiments. However, it will be apparent to one skilled in the art thatthe specific details are not required in order to practice the describedembodiments. Thus, the foregoing descriptions of specific embodimentsare presented for purposes of illustration and description. They are notintended to be exhaustive or to limit the described embodiments to theprecise forms disclosed. It will be apparent to one of ordinary skill inthe art that many modifications and variations are possible in view ofthe above teachings.

1. A method for resolving trending issues that are identified throughtext streams, the method comprising, at a client device: interfacingwith a server device that identifies a trending issue presented in aplurality of text streams, wherein the trending issue corresponds to atleast one computerized operation that is functioning improperly;receiving, from the server device, at least one solution for resolvingthe trending issue, wherein the at least one solution comprisesinstructions that, when executed, resolve the trending issue at least inpart; causing information derived from the trending issue and/or atleast one solution to be displayed on a display device that iscommunicatively coupled to the client device; and in response toreceiving a selection to enact the at least one solution: enacting theat least one solution by causing the instructions to be executed.
 2. Themethod of claim 1, wherein the information is displayed within a userinterface that is generated by the client device and output to thedisplay device.
 3. The method of claim 1, wherein the informationcomprises: information about the trending issue, information about theat least one solution, information about anomalous keywords detected inthe plurality of text streams, information about an overall volume ofthe plurality of text streams received over a particular period of time,or some combination thereof.
 4. The method of claim 1, wherein enactingthe at least one solution comprises: restarting one or more devicesassociated with the trending issue, escalating the trending issue to atleast one appropriate handler, providing a mass response to a pluralityof users who generated the plurality of text streams, providing a directresponse to at least one user of the plurality of users, or somecombination thereof.
 5. The method of claim 1, wherein the server deviceidentifies the trending issue by: filtering the plurality of textstreams using one or more machine learning models trained to identifyone or more textual patterns in the plurality of text streams.
 6. Themethod of claim 1, wherein the server device identifies the trendingissue by: preprocessing the plurality of text streams by tokenizing aportion of the plurality of text streams, removing one or more wordsfrom the plurality of text streams, or some combination thereof.
 7. Themethod of claim 1, wherein each of the plurality of text streams areincluded in a respective electronic message, a respective transcription,a respective chat history, a respective social media post, or arespective review.
 8. A non-transitory computer readable storage mediumconfigured to store first instructions that, when executed by aprocessor included in a client device, cause the client device toresolve trending issues that are identified through text streams, bycarrying out steps that include: interfacing with a server device thatidentifies a trending issue presented in a plurality of text streams,wherein the trending issue corresponds to at least one computerizedoperation that is functioning improperly; receiving, from the serverdevice, at least one solution for resolving the trending issue, whereinthe at least one solution comprises second instructions that, whenexecuted, resolve the trending issue at least in part; causinginformation derived from the trending issue and/or at least one solutionto be displayed on a display device that is communicatively coupled tothe client device; and in response to receiving a selection to enact theat least one solution: enacting the at least one solution by causing thesecond instructions to be executed.
 9. The non-transitory computerreadable storage medium of claim 8, wherein the information is displayedwithin a user interface that is generated by the client device andoutput to the display device.
 10. The non-transitory computer readablestorage medium of claim 8, wherein the information comprises:information about the trending issue, information about the at least onesolution, information about anomalous keywords detected in the pluralityof text streams, information about an overall volume of the plurality oftext streams received over a particular period of time, or somecombination thereof.
 11. The non-transitory computer readable storagemedium of claim 8, wherein enacting the at least one solution comprises:restarting one or more devices associated with the trending issue,escalating the trending issue to at least one appropriate handler,providing a mass response to a plurality of users who generated theplurality of text streams, providing a direct response to at least oneuser of the plurality of users, or some combination thereof.
 12. Thenon-transitory computer readable storage medium of claim 8, wherein theserver device identifies the trending issue by: filtering the pluralityof text streams using one or more machine learning models trained toidentify one or more textual patterns in the plurality of text streams.13. The non-transitory computer readable storage medium of claim 8,wherein the server device identifies the trending issue by:preprocessing the plurality of text streams by tokenizing a portion ofthe plurality of text streams, removing one or more words from theplurality of text streams, or some combination thereof.
 14. Thenon-transitory computer readable storage medium of claim 8, wherein eachof the plurality of text streams are included in a respective electronicmessage, a respective transcription, a respective chat history, arespective social media post, or a respective review.
 15. A clientdevice configured to resolve trending issues that are identified throughtext streams, the client device comprising a processor configured tocause the client device to carry out steps that include: interfacingwith a server device that identifies a trending issue presented in aplurality of text streams, wherein the trending issue corresponds to atleast one computerized operation that is functioning improperly;receiving, from the server device, at least one solution for resolvingthe trending issue, wherein the at least one solution comprisesinstructions that, when executed, resolve the trending issue at least inpart; causing information derived from the trending issue and/or atleast one solution to be displayed on a display device that iscommunicatively coupled to the client device; and in response toreceiving a selection to enact the at least one solution: enacting theat least one solution by causing the instructions to be executed. 16.The client device of claim 15, wherein the information is displayedwithin a user interface that is generated by the client device andoutput to the display device.
 17. The client device of claim 15, whereinthe information comprises: information about the trending issue,information about the at least one solution, information about anomalouskeywords detected in the plurality of text streams, information about anoverall volume of the plurality of text streams received over aparticular period of time, or some combination thereof.
 18. The clientdevice of claim 15, wherein enacting the at least one solutioncomprises: restarting one or more devices associated with the trendingissue, escalating the trending issue to at least one appropriatehandler, providing a mass response to a plurality of users who generatedthe plurality of text streams, providing a direct response to at leastone user of the plurality of users, or some combination thereof.
 19. Theclient device of claim 15, wherein the server device identifies thetrending issue by: filtering the plurality of text streams using one ormore machine learning models trained to identify one or more textualpatterns in the plurality of text streams.
 20. The client device ofclaim 15, wherein the server device identifies the trending issue by:preprocessing the plurality of text streams by tokenizing a portion ofthe plurality of text streams, removing one or more words from theplurality of text streams, or some combination thereof.